Practice Exam: Vault Associate (003)

Question bank: 100 · timed mock exam: 60 min

Official exam page on the vendor's site (opens in a new tab) Official exam guide (opens in a new tab) Official prep course (opens in a new tab)

Compare: Terraform Associate vs Vault Associate

  • Secrets engines 22 questions
  • Authentication methods 16 questions
  • Vault tokens 16 questions
  • Vault policies 12 questions
  • Vault deployment architecture 12 questions
  • Vault architecture fundamentals 8 questions
  • Vault leases 6 questions
  • Encryption as a Service 4 questions
  • Access management architecture 4 questions
Study mode (free) Exam mode (subscribers)

Free: 25 questions in study mode, all domains, no account.

Subscription: the 100 questions of this certification, the timed exam mode, and all other certifications too.

Subscribe · €9.99 / month

Secure card payment (Stripe) · No commitment · Cancel online

How to prepare for Vault Associate with InfraPrep

The 100 questions cover 9 domains: Secrets engines, Authentication methods, Vault tokens, Vault policies, Vault deployment architecture, Vault architecture fundamentals, Vault leases, Encryption as a Service, Access management architecture. 25 of them are free, without an account.

Study mode

Answer at your pace: each answer is corrected straight away, with an explanation and the link to the documentation it relies on.

Exam mode

A timed exam of 60 minutes, with a question map to flag and come back to questions before you submit.

Results by domain

Your score is broken down by domain, so you know what to review first.

Original questions

Every question is written from the public documentation, never copied from the exam. You can contest an answer from study mode.

10 free sample questions

Question 1 Authentication methods

A new platform engineer is reviewing a Vault design document and asks what role the auth methods play, as opposed to the secrets engines. Which description of an auth method is correct?

  1. It encrypts the storage backend so that data at rest cannot be read without the root key
  2. It stores, generates, or encrypts data on behalf of applications
  3. It verifies user or machine information against a system and generates a token on success
  4. It records every request and response for later forensic review
Show the answer and the explanation

Correct answer: C

Authentication is the verification of user- or machine-supplied information against an internal or external system; on success a token is generated.

Source: official documentation

Question 2 Vault policies

Apart from the built-in `default` policy, a token's only policy grants `read` on `secret/app1`. The token holder tries to list `secret/app2`. What happens, and why?

  1. The request is denied, because policies are deny by default and nothing grants access to that path
  2. The request succeeds, because the default behavior grants access to paths not mentioned in any policy
  3. The request succeeds with read-only access, because unlisted paths inherit the most restrictive capability
  4. The request succeeds, because listing is always allowed on any path
Show the answer and the explanation

Correct answer: A

Policies are deny by default; an action is allowed only when a policy explicitly grants it.

Source: official documentation

Question 3 Vault tokens

A platform runs thousands of short-lived functions per hour. Each function needs a Vault token for a few minutes, never renews it, and never creates child tokens. The Vault team wants to minimize the storage cost of issuing these tokens. Which token type fits best?

  1. Periodic service tokens
  2. Service tokens with a short TTL
  3. Batch tokens
  4. Root tokens with a short TTL
Show the answer and the explanation

Correct answer: C

Batch tokens need no storage to track them, so they are extremely lightweight and scalable; they lack renewal and child-token features, which this workload does not need.

Source: official documentation

Question 4 Vault leases

An engineer reads a dynamic secret with `vault read` and sees a `lease_id` field in the output. What is this value used for?

  1. It is the accessor of the token that requested the secret
  2. It is returned for every KV secret so that static values can be renewed
  3. It is the version number of the secret, used to roll back to a previous value
  4. It identifies the lease for commands like `vault lease renew` and `vault lease revoke`
Show the answer and the explanation

Correct answer: D

Vault always returns a `lease_id` when a dynamic secret is read; it is the ID used to renew or revoke that secret's lease.

Source: official documentation

Question 5 Secrets engines

An application must encrypt customer tax IDs before writing them to its own PostgreSQL database. The developers do not want to implement cryptography themselves, and the security team does not want the encrypted records stored inside Vault. Which secrets engine should they use?

  1. The database secrets engine, generating a new database user for each record
  2. KV version 2, storing each tax ID as a versioned secret
  3. The transit secrets engine, encrypting in Vault and storing the ciphertext in PostgreSQL
  4. The cubbyhole secrets engine, storing each tax ID in the application's token
Show the answer and the explanation

Correct answer: C

Transit's primary use case is to encrypt application data that is still stored in the application's own primary data store; Vault does not store it.

Source: official documentation

Question 6 Encryption as a Service

A developer has created the transit key `orders` and wants to encrypt a short text value from a shell script, then decrypt it later. Which approach is correct?

  1. Run `vault write transit/encrypt/orders plaintext="my text"` and rely on Vault to keep the ciphertext for later lookups
  2. Encrypt locally with a copy of the key exported from `transit/keys/orders`, then send only a hash to Vault
  3. Write the value to `transit/keys/orders` so that it is stored encrypted under the key
  4. Base64-encode the value, send to `transit/encrypt/orders`, store the ciphertext, and send it back to decrypt
Show the answer and the explanation

Correct answer: D

All plaintext sent to transit must be base64-encoded. Vault returns the ciphertext but does not store it: the caller stores it and sends it back to decrypt.

Source: official documentation

Question 7 Vault architecture fundamentals

A compliance officer asks what protects Vault data if an attacker gains direct read access to the storage backend. Which answer is correct?

  1. The storage backend is trusted to encrypt Vault data with its own keys
  2. The barrier encrypts data before sending it to the untrusted storage backend
  3. Data is protected only in transit by TLS and is written to storage in plaintext
  4. Each value is encrypted directly with the unseal key before it is written
Show the answer and the explanation

Correct answer: B

The storage backend sits outside the barrier and is considered untrusted, so Vault encrypts data before sending it there.

Source: official documentation

Question 8 Vault deployment architecture

A self-managed Vault HA cluster has one active node and two standby nodes, with request forwarding enabled. Request volume keeps growing, and the team proposes adding two more standby nodes to increase throughput. What is the best assessment?

  1. It will increase throughput, because each new standby adds its own copy of the storage backend
  2. HA does not add scalability; standbys forward to the active node, which handles all requests
  3. It will increase throughput only for write requests, because standbys handle writes
  4. It will double throughput, because every standby processes client requests independently
Show the answer and the explanation

Correct answer: B

HA mode protects against outages; it does not enable increased scalability. Requests received by a standby are forwarded to, and acted upon by, the active node.

Source: official documentation

Question 9 Access management architecture

A vendor application reads its database password from a configuration file and cannot be modified to call the Vault API. Which Vault component lets the team deliver secrets to it and handle authentication and token renewal automatically?

  1. The transit secrets engine, encrypting the configuration file
  2. Vault Agent's API proxy feature, which the application would call instead of Vault
  3. Vault Agent, with auto-auth and templates to render secrets into the configuration file
  4. Response wrapping of the password before it is written to the configuration file
Show the answer and the explanation

Correct answer: C

Vault Agent renders templates containing the secrets the application needs, without changes to the application, and its auto-auth feature authenticates and manages token renewal.

Source: official documentation

Question 10 Authentication methods

A CI/CD pipeline running on build agents must fetch deployment secrets from Vault with no human interaction. The security team wants credentials tied to a Vault-defined role and its policies. Which approach best fits this use case?

  1. Create a userpass account shared by all build agents
  2. Log in with the GitHub auth method using a developer's personal access token
  3. Store the root token in the pipeline configuration so the job never fails on permissions
  4. Enable the AppRole auth method and give the pipeline a role with the required policies
Show the answer and the explanation

Correct answer: D

AppRole lets machines and apps authenticate with Vault-defined roles and is oriented to automated workflows.

Source: official documentation

Frequently asked questions

Are there free questions, and do I need an account?

Yes. 25 questions of this certification are free in study mode, across all its domains, without a subscription and without registration. The account is created when you subscribe, at checkout.

How does the subscription work, and can I cancel?

One monthly subscription covers all certifications and the timed practice exams. There is no minimum period. You cancel online, at any time, with the "Cancel your contract" function in My account; cancellation takes effect at the end of the month already paid, and no further payment is taken.

Where do the questions come from?

Every question is original, written from the vendor's public documentation. Each answer comes with an explanation and a link to the documentation page it relies on. InfraPrep is not affiliated with the vendors, and certification names belong to their owners.

In which language are the questions?

The questions are written in English, also on the French version of the site.

Is the catalog updated?

Yes, the catalog changes over time: new certifications and new questions are added.